e1034b4e545377d162d6c3c82e00f52c6f47caea484154a12fb55a26dc627433

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00dad9aaa95d43a27cc799d188a79512.html
Size

57KB
MD5

00dad9aaa95d43a27cc799d188a79512
SHA1

1beb088f3ec126b35113da0286a567061f537ded
SHA256

e1034b4e545377d162d6c3c82e00f52c6f47caea484154a12fb55a26dc627433
SHA512

8ac84787a64317459518876bf5d0e61ebf58db4ad34510e5c349e765c5e58e8c215f7c437e0c2fe154386c010f1634644a5f1c71e896cb6fb334e088f8b18330
SSDEEP

1536:gQZBCCOdk0IxCYDd4f0fsf9fxf0fZfSf+fIfJfp4ftf7fFfUfsfMf7fAfXfPf2fX:gk2S0Ix+8kFJshqmgRi1jtckETYfH+qA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40573cb48336da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000046622d561b2f340af8eac1662b173cf4d2d5c475631c5301bd3ad0e70991a124000000000e8000000002000020000000a972449ab1312a144677c0db422ea932a936e84ec106059a0929c442a3f6360f90000000d9cf7dd7052e893e819389a860f68ec144a1581919fb89b368ed4ae0b451ddf70bb1d0f3863a26d9515710ea9034d5933ee28c976af8620616edeb4560f0acae1d2248709206a42c6390643945250821a91ef96452392bf27942eccfd6fb06be63d3431bfe8ce1368577b59c137b7cea5b0e1c60db0ac5026645cfbf6a53c7eba242304cb6fd127089281c030a4e694d4000000078a940b79cd168bbb02de8e7e5920978557ee4eb14cf3705fb11531c59008c50a10323701808f1b88d1c687b8c3d1e15c0e3c88b639d479ba09db172470a093f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000029132ef95690e1e3465480de55a1c10d12a2f13edcea64cf10c8123ac19e8ff0000000000e800000000200002000000021003a04996cbb6b10cd96f9d21e125e52dbfd2d2f4f15b8e08c52672f188e02200000001f32149a9c848c7471240b761c0ec7523a59524c8f1227947aba4de2e6fcf7a440000000231e52ce1975d6d037e18667536a0b59a38e8cf60edd974166eb20bf9a4c85d263257d5fa2589488fe8c6bd7c05630c9d374d316da4ae073323615538b04160a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409596028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6543C91-A276-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1988	2100	iexplore.exe	28
PID 2100 wrote to memory of 1988	2100	iexplore.exe	28
PID 2100 wrote to memory of 1988	2100	iexplore.exe	28
PID 2100 wrote to memory of 1988	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00dad9aaa95d43a27cc799d188a79512.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a1ea53f8a7390390106d8eca2eddf7

SHA1
181bbfcd503ff3db097c0f19532f36c44370d83b

SHA256
dcf352427f0ef7e4ae950ab23af816ff54ecb42d1237db193a4c48aaf6cb9a19

SHA512
f427c6a765109b77516192dfff18667da767704d2a58e71d9204d68d8eaf0b9c3823aaf42f1e5345e6c2e6f4ad10e24c0a2f180c5b5c51e5a763e5472b903fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdbe5c24e0c66c407ed73f26b79a6e79

SHA1
c684a24a31aba7031a06e0a07dd9c49798f6118e

SHA256
395b55395ade69917884ac14827fe9ba021f1799c10a58578e82fc79d816e05c

SHA512
b0306cd0226c699e7fa6cccaa00fd3851c140f0641034f1a0c263f76da15272d4c5e18d55c549b1f7ee7bae7d64e17eff09118bb69d6032e2fc41e8d92963199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd226758ae81e2aa9bd48667cb8368c

SHA1
3566c2c996e41d4ad177002dfbffb2718c2d7e86

SHA256
4fe29ab5cd30006354556d95cf1ec8b2560bcba7ae33b6bf3b7b53ca1d6cbeba

SHA512
b710fdee21b85d3eca8fc0432586986219584f722702cfcace7ca0e25644c8c7b3d5514136c2c1558307b07f9d910db24cb58599353778918438e3a384b6a6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9eb213eff354aa12899355780123f3f

SHA1
ad5a29f5325485643db4cc0b1b5fc87b74614799

SHA256
b04c9ecad073c28fa852c1e13ee78860058ce3d21005d23e6bef5ea552e2a607

SHA512
95af18f3dc4845915606534147ae1a9c636e3d5d1072bb058b874fdc1f860447ef54376a504c6707f852e992216765c9055e4043be79d3266d4ffc3e091c29fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3386850c94a2b4a6310c1cc74a209b2

SHA1
fe19808ce01c18f824838d0242a47c4c7a5d74e3

SHA256
ec982ae9a749f2d397dbacbf7ddc165ff95080c2ca300cb593b6a33ea687c195

SHA512
42907112eb9b3f57c09be2514ba00fac4300ec2711ed0fd1f8ffe4628c3acabe6ec7d97c92232d42bfc02c2a26f15a7431705f80d8e8a39d3d2c825c9199150c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db13b04be8e6a8d768a73968e1558220

SHA1
722bedb5cb244966a145c5ad26fb56af5dec5c92

SHA256
f20010e2bc6f817752309f64fd3f77edca4bef8b997db9f5478cbf45669129de

SHA512
9a625414e4ff04ce64ef01175b2065ae09c756a0a740b59db88c9b3f2449e620a0d36e53bb07683d7c0dacc8a54d711b3c3930ef342cbab462f342f9e1d725fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d115dba3f55fc77bde36df69d9d5dd8a

SHA1
c4501532d27d21352d929e6ca31ef7807fe2faeb

SHA256
d923458a26daa8f564609e8eeef261859ecf0ebc2f8fd51d18cb5d34fdc198dd

SHA512
4a0e74d2ab28353149e5226490b203b2fe5b596bee8aa146546cdba120dfe97832a1ae68888316feb93178ab13141c8b64190b1bb15b8e5c34e894d60987caec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78ac0f554ef582e4797b533dea630102

SHA1
9cce891cc9852679276a4fbb7abaeb111c624f94

SHA256
12e5de75eca4b36cec7e4fdcad26138db98455527071e0703c1e61ed23369ebc

SHA512
87c07da41da18e6b07834b28488b230793929891bcfdc11b7fd81e9e851153ac38188897b3fa42323cac6aebf247459203733ef8a0d0a4020c031c431cb79bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cceffd0d57a5bda8d7dd5df2d7c3ae0c

SHA1
fce5738c4d1cd231441b830a28fbb6ee9e34284a

SHA256
5332fe64711170ce5b45faf0b8c37f4ec36471c5b2813f49fd856cf6687110fa

SHA512
a7011261d64c714a64070ad330757a201a59df66e52568870759b81c5139f9a27fe2ebb9faa267eb380e38b66b3dd3cf46b4a47f44a22933c2cfb378eff1a319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96fe643496abeee2f27292105a71d9eb

SHA1
99e454ce9cfa0579e49aaed529407ae88a8dcd02

SHA256
765197b1cab2d11d0e7bce470789e9e43464211d6d3a2caffa2f1edf592fa5e3

SHA512
08da2b37a4627df4f4c2c1636853275035acf4a71bfd988e765d968620d0c77d5754eb5890bd89b0aa1e33bab88349176228103cb0b4617edf4416ac1e747d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cf514307c0072e071929c813d79f025

SHA1
843ca5065cf884949df5be684f072ec0caea9767

SHA256
27731ba3c7f4c10a05377eb1b8ba219dcd2a768165ef9b5afd67988e7584847a

SHA512
9ec74832e5f5033232874c66b5a6a1d96b844659f6ee7693c70b7c41ccb7650d71de6e3433bfb4eaff06a659d9e1959646b926297ca8f943ffeace4e91f03e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa93b1f9df8578a369d37fc11ea72a1

SHA1
c34e5314b0dab3542c8282f91427ec0c87026591

SHA256
a9bf341c3a2d7e42a92e202d244f52755656f5ec443066e651c2373a900920be

SHA512
bd68bc1643fb3418db680536b7bb3ca6babce258ba860cd56bd9d5fbe23db987dd5f1e5d67cec5e5441385f11dad021b6d61dc80de6858789066476418d77b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604c0e7e0d610d317aa1af7755d0ce43

SHA1
5ddb874cdce4b8bdde1b8b226dab60837e96441f

SHA256
1c80fc75f876319b53e7bfce39d02c82ca3c55e794bb94e83cbbc948115e9c39

SHA512
c0d750931a14bf90e71540dc16a7089b48223381e16181aaccaeb8d0be707a2ef0912d794f69335018612fb6366a6cff73be7748b05e0ec584690ecdd27634e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb2b4ec4f0fecca934312f359137928

SHA1
86cd77450f94984fb7275fae3f76756db23225f6

SHA256
ce8d037925058e38b0d1ff21325ad16643b7acbf4fb0e798bea249bbeb46f33b

SHA512
808198e15f3137d96891d1dea3fcf830bb6a98ecadafb346338cd531a1e4beaf0882be8290f75484952abbe8ebb3b3de254d8ee4d93c83951c1ce450e7ba3451

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D25.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D56.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit